Logging

PowerShell comes packed with many logging capabilities, which can be seen in the EventLog.

Logs for Windows PowerShell:

This log source contains basic information about Windows PowerShell. We have actually used this log source previously, when we searched for the engine version filtering Event ID 400.

Remoting Logs:

These logs are mainly used for troubleshooting purposes, to validate misbehavior on remoting. They can also be used for forensic approaches to validate the established connections from or to specific machines.

PowerShell Admin and Operational logs:

The last ones, Admin and Operational, can be found in the event logs in the following path: Applications and Service Logs | Microsoft  | Windows | PowerShell. In the Admin log file, all admin tasks are logged. It is important to validate this log file, as a re-enabled PowerShell version 2 would show up here. And the last ones are the operational logs. 

PowerShell code logging can generally be split into the following three log types...